SUNNYVALE — In an explosive revelation, Yahoo has admitted that it knew in 2014 that it had been hacked — a breach the company did not disclose until this year — and its $4.8 billion sale to Verizon could fall through.

The hack, considered the world’s largest data breach, stole personal information from more than half a billion user accounts.

“There is no assurance that the Sale transaction will be consummated in a timely manner or at all,” Yahoo said in a filing Wednesday.

Meanwhile, with millions of people wondering whether their stolen Yahoo data has fallen into the hands of identity thieves, law enforcement agencies on Monday started investigating a hacker’s claim to having data from Yahoo users’ accounts, the filing said.

The filing contradicts the troubled Sunnyvale internet firm’s September statement that it discovered the 2014 data breach during a “recent” investigation. A “state-sponsored actor” had perpetrated the theft, Yahoo said.

But the company’s Securities and Exchange Commission filing on Wednesday revealed the firm’s knowledge of “prior access to the Company’s network by a state-sponsored actor that the Company had identified in late 2014.”

Yahoo is now investigating who in the company knew in 2014 about the breach, the filing said.

“An Independent Committee of the Board, advised by independent counsel and a forensic expert, is investigating, among other things, the scope of knowledge within the Company in 2014 and thereafter regarding this access,” Yahoo said in its filing.

News that at least some in Yahoo were aware in 2014 of the breach could give Verizon a legal reason to exit the $4.8 billion deal, said analyst Joel Espelien of The Diffusion Group.

“My guess is Verizon’s having some buyer’s remorse and that this cybersecurity breach may provide the out that they were looking for, either to significantly revisit the purchase price of this deal or walk away completely,” Espelien said. “Verizon probably does have a walk right under this deal based on Yahoo’s failure to disclose the 2014 hack.”

Other grounds Verizon could use to back out of the deal could include damage from the hack to Yahoo’s value, potential problems with Yahoo’s legal compliance, and possibly incomplete disclosure to Verizon of all relevant information about the company, Espelien said.

Breakdown of the deal would leave Yahoo in even worse shape than it is now, said Peter Csathy, chairman of digital media advisory firm CREATV Media.

“Morale, which is already low, will hit the floor, and that means your best remaining people are at substantial risk to leave. Execution, which is already challenged, starts falling apart,” Csathy said.

Verizon could use the latest revelations to knock down the price it pays, but if the telecommunications company pulls out, Yahoo will still get sold — for a considerably lower price than $4.8 billion, Csathy said.

“There would be a buyer because Yahoo has substantial assets,” Csathy said. “But it’s not going to be a pretty picture for investors.”

Verizon spokesman Jim Gerace, asked Thursday how the information in Yahoo’s filing might affect the sale, said Verizon was “still evaluating the situation and have come to no final conclusions.”

Yahoo’s filing also revealed how the firm believes the hacking entity may have accessed users’ information in 2014. Forensic experts are looking into “certain evidence and activity” indicating that the intruder created “cookies that could have enabled such intruder to bypass the need for a password to access certain users’ accounts or account information.”

Yahoo said in the filing it would investigate the hacker’s claim to possess Yahoo users’ data.

As for when Yahoo users might be notified whether they’re affected, a spokesman said Thursday it depends on what the company finds in its assessment of the data from law enforcement.

While raising the possibility the Verizon deal could fall through, Yahoo also suggested that if Verizon did go ahead with the purchase, the price might tumble.

“The anticipated benefits of the Sale transaction may not be realized,” Yahoo’s filing said.

Yahoo said it is facing numerous state, federal and foreign investigations over the 2014 hack. It is also dealing with at least 23 class-action lawsuits related to what it calls the “Security Incident.”

In the past month, including during the company’s earnings call, Verizon executives have said that they are exploring what the Yahoo hack means for the planned acquisition. The companies’ lawyers started talking in late October about the material impact of the breach.

Shares of Yahoo were down 2.6 percent to $40.16 amid a broader tech stocks sell-off.

Ethan Baron is a business reporter at The Mercury News, and a native of Silicon Valley before it was Silicon Valley. Baron has worked as a reporter, columnist, editor and photographer in newspapers and magazines for 25 years, covering business, politics, social issues, crime, the environment, outdoor sports, war and humanitarian crises.

More in Business

Officials have flipped the switch on a $1 billion solar power generation station in the Mojave Desert south of Las Vegas that they say can produce enough electricity to power about 80,000 California homes.